Re: Re: [KAPDA::#16] - SMF SQL Injection

[quote]
I'm a developer from over at simplemachines and I do not see how this can pose an exploit? Let's examine the code piece by piece:

The code is entered at this point:
if (!is_numeric($_REQUEST['start']))

So, will be executed if $_REQUEST['start'] is a string. It's then used in the query. However, it's used in the query in this piece of code:

substr(strtolower($_REQUEST['start']), 0, 1)

So, the string is set to lower case, and then only the FIRST letter is used within the query. How can anyone exploit the database with a one character insertion? Of course this is within single quotes as well, so it cannot even be a command.

I simply cannot see how you could possibly exploit SQL from this?
[/quote]

mphhh, correct...
the only problem I see is path disclosure, 'cause you can inject only a one char string:

http://[target]/smfrc1/index.php?action=mlist;sort=realName;start=\;desc

query becomes:

SELECT COUNT(ID_MEMBER) FROM smf_members WHERE LOWER(SUBSTRING(realName, 1, 1)) < '\' AND is_activated = 1

and at screen, you have:

Errore di sintassi nella query SQL vicino a ''\'
AND is_activated = 1' linea 3
File: [full_application_path]Memberlist.php
Line: 162

but I think you cannot inject commands...

Relevant Pages

  • Re: Still need help - on form
    ... >I think the command button for the append query may work. ... >though my invoice # in the invoice table is not assigned until the report it ... not sure if there will ever be an invoice generated for that quote. ...
    (microsoft.public.access.forms)
  • Re: Form/subform problems - Newbie
    ... The query can be just... ... Candia Computer Consulting. ... Make sure that the main form query RecordSource is based on just the Quotes table ... When you open the query behind the Quote form, can you manually edit the fields. ...
    (microsoft.public.access.forms)
  • Re: cant get unmatched query to work.
    ... once I applied the query you helped me with I ... as such if a supplier had only submitted a drystone quote the ... to modify my query to find sites suppliers haven't quoted for to one ... have 2 no quote fields for each type of rock. ...
    (comp.databases.ms-access)
  • Re: Selection from multi select list box....
    ... You can still use the approach of creating the Mailing record, and then storing the customers in the mailing. ... the query you created last time: turn it into an Append query (Append ... > there a way to track which customers I sent the quote to (which people> I ...
    (microsoft.public.access.reports)
  • Re: cant get unmatched query to work.
    ... once I applied the query you helped me with I ... as such if a supplier had only submitted a drystone quote the ... the query I get a grayed out box rather than a tick or an empty box ... to modify my query to find sites suppliers haven't quoted for to one ...
    (comp.databases.ms-access)